Analysis
-
max time kernel
28s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28-03-2023 07:42
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
General
-
Target
file.exe
-
Size
375KB
-
MD5
d2bf1d20ac97954ca86849c1f7c1a3c2
-
SHA1
7cd8869ba00b254c8dfc6aa6a649b2c20a1d0325
-
SHA256
43ae412088adb7eb0ea5df2b569d354d3d737e97b4581bb45c077b03506de5b0
-
SHA512
2108b712479e2185dd0c33db18c981768c3bd91a14685534b472b348144e959e83fd6ce49937d7133e4d92154ce6b5d3d4b8310655875b79d017e215d78f9114
-
SSDEEP
6144:7sQwFZgjDCOC3MnQFMru0g+xh4Q/KhTMwacF2X8pyMp7UJ:7sQwvg/CbMwMTg+f4m8Ttv2X+DUJ
Malware Config
Extracted
redline
@chicago
185.11.61.125:22344
-
auth_value
21f863e0cbd09d0681058e068d0d1d7f
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/1656-55-0x00000000047E0000-0x000000000483A000-memory.dmp family_redline behavioral1/memory/1656-56-0x00000000049D0000-0x0000000004A28000-memory.dmp family_redline behavioral1/memory/1656-57-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-58-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-60-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-62-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-64-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-68-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-67-0x0000000007100000-0x0000000007140000-memory.dmp family_redline behavioral1/memory/1656-71-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-73-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-77-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-79-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-81-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-83-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-85-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-87-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-89-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-91-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-93-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-95-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-97-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-99-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-103-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-101-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-107-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-109-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-105-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-111-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-113-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-115-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-117-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-119-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-121-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-123-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-75-0x00000000049D0000-0x0000000004A22000-memory.dmp family_redline behavioral1/memory/1656-850-0x0000000007100000-0x0000000007140000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
file.exepid process 1656 file.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
file.exedescription pid process Token: SeDebugPrivilege 1656 file.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1656-55-0x00000000047E0000-0x000000000483A000-memory.dmpFilesize
360KB
-
memory/1656-56-0x00000000049D0000-0x0000000004A28000-memory.dmpFilesize
352KB
-
memory/1656-57-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-58-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-60-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-62-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-66-0x00000000002D0000-0x0000000000332000-memory.dmpFilesize
392KB
-
memory/1656-64-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-68-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-67-0x0000000007100000-0x0000000007140000-memory.dmpFilesize
256KB
-
memory/1656-69-0x0000000007100000-0x0000000007140000-memory.dmpFilesize
256KB
-
memory/1656-71-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-73-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-77-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-79-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-81-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-83-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-85-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-87-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-89-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-91-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-93-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-95-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-97-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-99-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-103-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-101-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-107-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-109-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-105-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-111-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-113-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-115-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-117-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-119-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-121-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-123-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-75-0x00000000049D0000-0x0000000004A22000-memory.dmpFilesize
328KB
-
memory/1656-850-0x0000000007100000-0x0000000007140000-memory.dmpFilesize
256KB